CN111538869B

CN111538869B - Transaction abnormal group detection method, device and equipment

Info

Publication number: CN111538869B
Application number: CN202010359124.4A
Authority: CN
Inventors: 毛琼
Original assignee: Alipay Hangzhou Information Technology Co Ltd
Current assignee: Alipay Hangzhou Information Technology Co Ltd
Priority date: 2020-04-29
Filing date: 2020-04-29
Publication date: 2023-05-26
Anticipated expiration: 2040-04-29
Also published as: CN111538869A

Abstract

The embodiment of the specification discloses a method, a device and equipment for detecting abnormal transaction groups, wherein the method comprises the following steps: constructing an association relationship map between accounts contained in transaction data based on the transaction data of a user; grouping accounts contained in the transaction data based on the association relationship graph between the accounts to obtain at least one account group; determining whether the account group is an abnormal group with a preset risk or not in a pattern matching mode based on an association relation pattern between accounts contained in the at least one account group, an abnormal subgraph in a preset abnormal pattern database and a preset pattern processing model.

Description

Transaction abnormal group detection method, device and equipment

Technical Field

The present disclosure relates to the field of computer technologies, and in particular, to a method, an apparatus, and a device for detecting a transaction anomaly group.

Background

With the continuous development of terminal technology and network technology, online transaction becomes a current important transaction form, and thus, many network blackouts occur, and in order to protect the resources and account security of users, a transaction platform correspondingly also has many risk prevention and control mechanisms (such as a risk prevention and control mechanism for fraud, a risk prevention and control mechanism for gambling, a risk prevention and control mechanism for marketing, and the like) so as to combat the network blackouts. With the continuous upgrade of the countermeasure between the transaction platform and the network black product, the network black product is more and more approaching to a group (or group) form, and the damage degree of the black product group to the transaction user is very high. How to detect the black product group composition from the transaction is an important problem to be solved. For this reason, it is necessary to provide a technical solution capable of detecting the black product group from the transaction.

Disclosure of Invention

The embodiment of the specification aims to provide a method, a device and equipment for detecting abnormal transaction groups, so as to provide a technical scheme capable of detecting black product groups from transactions.

In order to achieve the above technical solution, the embodiments of the present specification are implemented as follows:

the embodiment of the specification provides a method for detecting a transaction abnormal group, which comprises the following steps: and constructing an association relation map between accounts contained in the transaction data based on the transaction data of the user. And grouping the accounts contained in the transaction data based on the association relation graph between the accounts to obtain at least one account group. Determining whether the account group is an abnormal group with a preset risk or not in a pattern matching mode based on an association relation pattern between accounts contained in the at least one account group, an abnormal subgraph in a preset abnormal pattern database and a preset pattern processing model.

The embodiment of the specification provides a detection device of abnormal transaction group, the device includes: and the first map construction module is used for constructing an association relation map between accounts contained in the transaction data based on the transaction data of the user. And the group division module is used for grouping the accounts contained in the transaction data based on the association relation graph among the accounts to obtain at least one account group. The abnormal group determining module is used for determining whether the account group is an abnormal group with a preset risk or not in a pattern matching mode based on an association relation pattern between accounts contained in the at least one account group, an abnormal subgraph in a preset abnormal pattern database and a preset pattern processing model.

The embodiment of the specification provides a detection device of abnormal transaction group, the detection device of abnormal transaction group includes: a processor; and a memory arranged to store computer executable instructions that, when executed, cause the processor to: and constructing an association relation map between accounts contained in the transaction data based on the transaction data of the user. And grouping the accounts contained in the transaction data based on the association relation graph between the accounts to obtain at least one account group. Determining whether the account group is an abnormal group with a preset risk or not in a pattern matching mode based on an association relation pattern between accounts contained in the at least one account group, an abnormal subgraph in a preset abnormal pattern database and a preset pattern processing model.

Drawings

In order to more clearly illustrate the embodiments of the present description or the technical solutions in the prior art, the drawings that are required in the embodiments or the description of the prior art will be briefly described below, it being obvious that the drawings in the following description are only some of the embodiments described in the present description, and that other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

FIG. 1 is a diagram illustrating an embodiment of a method for detecting transaction anomaly groups according to the present disclosure;

FIG. 2 is a schematic diagram of an association graph according to the present disclosure;

FIG. 3A is a diagram illustrating another embodiment of a method for detecting transaction anomaly groups according to the present disclosure;

FIG. 3B is a schematic flow chart of a model training method in the present specification;

FIG. 4 is a schematic diagram of a similarity algorithm according to the present disclosure;

FIG. 5 is a schematic diagram illustrating an embodiment of a device for detecting transaction anomalies;

fig. 6 is a schematic diagram illustrating an embodiment of a transaction anomaly group detection apparatus according to the present disclosure.

Detailed Description

The embodiment of the specification provides a method, a device and equipment for detecting a transaction abnormal group.

In order to make the technical solutions in the present specification better understood by those skilled in the art, the technical solutions in the embodiments of the present specification will be clearly and completely described below with reference to the drawings in the embodiments of the present specification, and it is obvious that the described embodiments are only some embodiments of the present specification, not all embodiments. All other embodiments, which can be made by one of ordinary skill in the art without undue burden from the present disclosure, are intended to be within the scope of the present disclosure.

Example 1

As shown in fig. 1, the embodiment of the present disclosure provides a method for detecting a transaction anomaly group, where an execution body of the method may be a server, where the server may be an independent server, may also be a server cluster formed by a plurality of servers, and the server may be a background server of a certain service (such as a financial service or an online shopping service), or may also be a background server of a certain application program. The method specifically comprises the following steps:

in step S102, an association relationship map between accounts included in transaction data is constructed based on the transaction data of the user.

The transaction data may be data generated in the process of carrying out a transaction with the user, and the transaction data may include data of various different contents, such as transaction time, account information of both transaction parties, and the number of resources of the transaction. The association relationship may be a transaction relationship between different accounts, a friend relationship between corresponding users, etc., and may be specifically set according to actual situations.

In implementation, with the continuous development of terminal technology and network technology, online transactions become a current important transaction form, and thus, many network black products appear, and in order to protect the resources and account security of users, a transaction platform correspondingly appears many risk prevention and control mechanisms (such as a risk prevention and control mechanism for fraud, a risk prevention and control mechanism for gambling, a risk prevention and control mechanism for marketing, etc.), so as to combat the network black products. With the continuous upgrade of the countermeasure between the transaction platform and the network black product, the network black product is more and more approaching to a group (or group) form, and the damage degree of the black product group to the transaction user is very high. How to detect the black product group composition from the transaction is an important problem to be solved. For this reason, it is necessary to provide a technical solution capable of detecting the black product group from the transaction. The embodiment of the present disclosure provides an optional processing manner, which may specifically include the following:

In view of the fact that the risk of fraud, the risk of gambling or the risk of marketing is generally suitable for abstraction by using a pattern, it is possible to detect an abnormal group in a transaction, in particular, the number of users of a transaction platform is often large, and a plurality of different users may perform a certain transaction or a plurality of transactions at the same time, so that a real-time transaction data stream of the transaction platform may be obtained, and an abnormal group detection may be performed on the real-time transaction data stream, and for this reason, account information included in the transaction data may be obtained based on the transaction data obtained from the transaction platform. And the association relation existing between the accounts corresponding to the different account information can be determined based on the transaction data, and then, the association relation map between the accounts contained in the transaction data can be constructed in a map form based on the association relation between the account information and the different accounts.

In step S104, the accounts included in the transaction data are grouped based on the association relationship map between the accounts, so as to obtain at least one account group.

In the implementation, after the association relationship map between the accounts included in the transaction data is obtained in the above manner, the accounts in the association relationship map may be grouped by a preset grouping rule to obtain at least one account group, where the grouping rule may be a rule summarized based on historical data, may also be a rule set by a preset algorithm, for example, a distance between any two accounts may be calculated based on a cosine distance algorithm, the corresponding accounts may be grouped based on a magnitude relationship of the distance, or may also be a grouping of the corresponding accounts by a community discovery or other manner, and may be specifically set according to an actual situation, which is not limited in the embodiment of the present specification.

For example, as shown in fig. 2, each circle and the number therein represent an account, and the accounts in each dashed box may form an account group, and the connection between different accounts indicates that a predetermined association relationship exists between the accounts.

In step S106, based on the association relationship graph between the accounts included in at least one account group and the anomaly subgraph in the predetermined anomaly graph database, and the predetermined graph processing model, it is determined whether the account group is an anomaly group with a predetermined risk by means of graph matching.

The pattern processing model may be a model for determining whether the group to be detected is an abnormal group with a predetermined risk through pattern matching. The predetermined risk may be any risk, such as in particular fraud risk, gambling risk, marketing, etc.

In practice, a atlas handling model may be preset, which may be implemented by: the method can be used for processing the association relation map in a map structure Embedding mode, and can realize that the intra-class distance is smaller and the inter-class distance is larger by combining the map structure Embedding, and can be used for directly mapping the map to a distance space by constructing an Embedding mode, and the method for optimizing the Embedding can be summarized as follows: and constructing a plurality of groups of triples (A, P, N), wherein the element A and the element P belong to the same category, the element A and the element N belong to different categories (for example, the element A and the element P can be the same individual, and the element A and the element N can be different individuals), and optimizing the Embedding through learning so that the distance between the element A and the element P in a distance space is smaller than the distance between the element A and the element N. For this reason, the triplet may be constructed, the association relationship map between the accounts included in the account group may be used as the element a in the triplet, and the element P belonging to the same category as the element a may be acquired based on the element a.

The similarity algorithm may be preset according to actual situations, and the similarity algorithm may include various types, for example, the corresponding similarity may be determined based on a distance algorithm, such as a euclidean distance algorithm, a manhattan distance algorithm, a chebyshev distance algorithm, and the like. After the element a and the element P in the triples are obtained in the above manner, the element N in the triples needs to be obtained, so that an abnormal spectrum database may be preset in a plurality of different manners, and the abnormal spectrum database may include one or more association relationship spectrums corresponding to account groups with predetermined risks (each association relationship spectrum may be used as an abnormal subgraph), where the abnormal subgraph may be determined based on the report information of the user, may be determined by purchasing information from the user or other institutions through purchasing, etc., and may be specifically set according to practical situations, and the embodiment of the present specification does not limit the present specification. After the abnormal map database is obtained in the above manner, the abnormal subgraph in the abnormal map database can be used as the element N in the triplet, so that the triplet can be obtained.

Corresponding atlas handling models may be constructed based on the three elements in the triples. The association relationship pattern between the accounts included in at least one account group and the abnormal subgraph in the predetermined abnormal pattern database may be input into the pattern processing model, and the similarity between the association relationship pattern between the accounts included in the account group and the abnormal subgraph in the predetermined abnormal pattern database may be determined through the pattern processing model, for example, the similarity algorithm may be an euclidean distance algorithm, and each element of the three elements in the triplet may be converted into a vector, that is, the association relationship pattern between the accounts included in the disturbed account group may be converted into a vector, the association relationship pattern between the accounts included in the account group may be converted into a vector, and the abnormal subgraph may be converted into a vector. Then, based on the vectors corresponding to the three elements, the similarity between the association relationship graph among the accounts contained in the account group and the abnormal subgraph in the preset abnormal graph database can be calculated through the Euclidean distance algorithm.

After the similarity between the association relationship graph among the accounts contained in the account group and the abnormal subgraph in the preset abnormal graph database is obtained in the above manner, the obtained similarity value can be compared with the preset similarity threshold value to obtain the association relationship graph among the accounts contained in the account group with the similarity value larger than the similarity threshold value and the abnormal subgraph, and the risk corresponding to the obtained abnormal subgraph can be used as the risk corresponding to the account group, if the risk corresponding to the abnormal subgraph is a fraud risk, the risk corresponding to the account group is also a fraud risk.

If the number of similarity degrees larger than the similarity threshold value is plural, one of the plural number of similarity degrees may be selected, or the one having the smallest number of similarity degrees may be selected, or the one having the largest number of similarity degrees may be selected, or the like, and the number may be specifically set according to the actual situation.

The embodiment of the specification provides a detection method of a transaction abnormal group, which is characterized in that an association relation graph between accounts contained in transaction data is constructed based on the transaction data of a user, the accounts contained in the transaction data are grouped based on the association relation graph between the accounts to obtain at least one account group, and based on the association relation graph between the accounts contained in the at least one account group and an abnormal subgraph in a preset abnormal graph database and a preset graph processing model, whether the account group is an abnormal group with preset risk is determined in a graph matching mode, so that a result of whether the account group is an abnormal group with preset risk is obtained, and therefore, whether the group to be detected is the abnormal group with preset risk can be determined in the graph matching mode, the detection process of the transaction abnormal group can be simplified, and the detection method can be applied to a complex graph.

Example two

As shown in fig. 3A, the embodiment of the present disclosure provides a method for detecting a transaction anomaly group, where an execution subject of the method may be a server, where the server may be an independent server, may also be a server cluster formed by a plurality of servers, and the server may be a background server of a certain service (such as a financial service or an online shopping service), or may also be a background server of a certain application program. The method specifically comprises the following steps:

in step S302, a plurality of history account groups and an association relationship map between accounts included in each history account group are acquired.

In implementation, the historical account group may be acquired in various manners, for example, related information of the group may be acquired from other organizations or institutions through purchase or exchange, the acquired related information of the group may be combined with pre-registered account information to determine account information of a user included in the group, so that an account group corresponding to the group may be obtained, and the obtained account group may be used as the historical account group. In addition, an information acquisition mechanism can be preset in the server to acquire related behavior data of registered accounts, the association relation between different accounts can be determined based on the acquired related behavior data, the accounts belonging to the same group can be further obtained, corresponding account groups can be constructed based on the accounts belonging to the same group, and the constructed account groups can be used as historical account groups. In addition to the two approaches described above, historical account groups may be obtained in a number of different ways. By the method, a plurality of different historical account groups can be obtained.

After a plurality of historical account groups are obtained, transaction information and behavior data corresponding to each account in the historical account groups can be obtained for each historical account group, and the association relationship among different accounts in the historical account groups can be determined based on the transaction information and the behavior data corresponding to each account, so that the association relationship map among the accounts contained in each historical account group can be obtained.

In step S304, the graph processing model is trained based on the association relationship graphs among the accounts included in the plurality of historical account groups, and a trained graph processing model is obtained.

The above-mentioned processing in step S304 may be varied, and an alternative processing manner is provided below, and as shown in fig. 3B, the following processing from step S3042 to step S3048 may be specifically included, where two history account groups may be randomly selected from a plurality of history account groups, and may be referred to as a first history account group and a second history account group, respectively, for convenience of description.

In step S3042, the order of the accounts in the association map between the accounts included in the first historical account group is disturbed, so as to obtain the association map between the disturbed accounts included in the first historical account group.

In implementation, the processing of the association relation graph through a triple Loss model can be considered, wherein the triple Loss model can realize that the intra-class distance tends to be small and the inter-class distance tends to be large, the triple Loss model is a Loss function, the graph can be directly mapped to the distance space through constructing an Embedding mode, and the method for optimizing the Embedding can be summarized as follows: multiple sets of triples (a, P, N) are constructed, where element a and element P belong to the same class and element a and element N belong to different classes (e.g., element a and element P may be the same individual and element a and element N may be different individuals). For this purpose, the triplet may be constructed, the association relationship map between the accounts included in the history account group may be used as the element a in the triplet, the element P belonging to the same category as the element a may be acquired based on the element a, and the element P may be acquired in the following optional manners: the order of the accounts in the association map between the accounts included in the first historical account group is disturbed, and specifically, the order of the accounts in the association map between the accounts included in the first historical account group may be randomly adjusted, so as to obtain the association map between the accounts included in the disturbed first historical account group.

In step S3044, the graph processing model is trained based on the disturbed association relationship graph between the accounts included in the first historical account group, the association relationship graph between the accounts included in the first historical account group, and the association relationship graph between the accounts included in the second historical account group, so as to obtain a trained graph processing model.

In an implementation, an adjacency matrix corresponding to the association relationship pattern between the accounts included in the first history account group, and an adjacency matrix corresponding to the association relationship pattern between the accounts included in the second history account group may be determined based on the association relationship pattern between the accounts included in the disturbed first history account group, the association relationship pattern between the accounts included in the first history account group, and the association relationship pattern between the accounts included in the second history account group, respectively.

The adjacency matrix may be a matrix representing the adjacent relation between nodes of the map, and typically, a one-dimensional array may be used to store node data in the map, and a two-dimensional array may be used to store data of the relation between nodes in the map, where the two-dimensional array may be referred to as an adjacency matrix, and the adjacency matrix may be divided into a directed graph adjacency matrix and an undirected graph adjacency matrix, where the adjacency matrix may be symmetrical for undirected graphs. The numerical value in the adjacency matrix may represent whether there is an association relationship between two nodes, or may also represent a weight between two nodes, or the like, and may be specifically set according to an actual situation, which is not limited in the embodiment of the present specification.

It should be noted that, an adjacency matrix corresponding to the association relationship map between the accounts included in the first history account group after the disruption may be constructed based on the association relationship between different accounts in the association relationship map between the accounts included in the first history account group after the disruption, and similarly, an adjacency matrix corresponding to the association relationship map between the accounts included in the first history account group may be constructed based on the association relationship between different accounts in the association relationship map between the accounts included in the first history account group, and an adjacency matrix corresponding to the association relationship map between the accounts included in the second history account group may be constructed based on the association relationship between different accounts in the association relationship map between the accounts included in the second history account group.

The graph processing model may be trained based on the adjacency matrix corresponding to the association relationship graph between the accounts included in the disturbed first historical account group, the adjacency matrix corresponding to the association relationship graph between the accounts included in the first historical account group, and the adjacency matrix corresponding to the association relationship graph between the accounts included in the second historical account group, to obtain a trained graph processing model.

Specifically, based on the above-mentioned related matters, the atlas handling model may be constructed in a plurality of different manners, and two alternative manners are provided below, namely, the atlas handling model may be constructed by a preset neural network model, an Embedding function and a Triplet Loss model, where the neural network model may be a graph neural network model, or the neural network model may be a convolutional neural network model.

For example, as shown in fig. 4, taking the graph neural network model, the Embedding function and the Triplet Loss model as an example, three elements in the triplets (that is, the association graph between the accounts included in the disturbed first historical account group, the association graph between the accounts included in the first historical account group and the association graph between the accounts included in the second historical account group) are obtained in the above manner, after the adjacency matrix corresponding to each element is obtained, the adjacency matrix may be input into the graph neural network model in fig. 4 to calculate, so as to obtain corresponding output results respectively, then the output results may be provided to the Embedding function, so that the obtained output results are mapped, so as to obtain data of a preset dimension, and then the data of the preset dimension may be processed through the Triplet Loss model, so as to obtain the characterization information corresponding to the association relationship between the accounts included in the graph in the first historical account group.

As shown in fig. 4, taking the construction of the graph neural network model, the effect function and the replet Loss model as an example, by using the graph processing model, three elements in the triples (namely, the incidence relation graph between accounts included in the disturbed historical account group, the incidence relation graph between accounts included in the historical account group and the abnormal subgraph in the abnormal graph database) are obtained in the above manner, after the adjacency matrix corresponding to each element is obtained, the adjacency matrix corresponding to the obtained triples can be input into the graph neural network model in fig. 4 for calculation, corresponding output results are respectively obtained, then the output results can be provided for the effect function, so that the obtained output results are mapped, data in preset dimensions can be obtained, the data in preset dimensions can be processed through the replet Loss model, so that the similarity relation between the three elements in the triples is obtained, the accuracy of the output results is judged, and then the above processing model is continuously trained through other triples until the preset output results of the processing model exceeds the preset training patterns, and the accuracy of the graph model can be obtained.

It should be noted that, in addition to the above-mentioned construction, the atlas processing model may be constructed in a variety of different manners, for example, the atlas processing model may be constructed by a convolutional neural network model, an Embedding function, a Triplet Loss model, and the like.

For example, the atlas processing model is constructed by a convolutional neural network model, an assembled function and a Triplet Loss model, then an adjacency matrix corresponding to each element in the Triplet may be used as a set of training samples, the training samples may be input into the convolutional neural network model to perform calculation, corresponding output results are obtained respectively, then the output results may be input into the assembled function, so that the obtained output results are mapped to obtain data with preset dimensions, the data with preset dimensions may be processed by the Triplet Loss model, thereby obtaining a similarity relationship between three elements in the Triplet, and determining the accuracy of the output results, and then training the atlas processing model again by other triplets until the accuracy of the output results of the atlas processing model exceeds a predetermined threshold, thereby obtaining the atlas processing model after training.

The method is used for training to obtain the atlas processing model, at this time, undetermined parameters contained in the trained atlas processing model are all obtained through the training process, and then the trained atlas processing model can be used for detecting abnormal groups possibly existing in the real-time transaction data stream, and the method can be specifically referred to the following processing of step S306-step S316.

In step S306, an association relationship map between accounts included in the transaction data is constructed based on the transaction data of the user.

The specific processing procedure of the step S306 may be referred to the related content of the step S102 in the first embodiment, which is not described herein.

After the association relationship map between the accounts included in the transaction data is constructed in the above manner, the specific accounts included in the association relationship map may be filtered, so as to reduce the processing pressure on the server, which may specifically include the processing in the following step S308.

In step S308, a predetermined account included in the association relationship map between the accounts is filtered, so as to obtain the association relationship map between the filtered accounts, where the predetermined account includes one or more of a preset whitelist account and an account whose transaction number exceeds a predetermined threshold value within a predetermined time.

In implementation, in order to reduce the processing pressure of the server in the subsequent processing, a white list may be preset according to the actual situation, where relevant information about accounts without risk may be recorded in the white list, and in addition, the server may record accounts with transaction times exceeding a predetermined threshold value within a predetermined duration, where the predetermined duration may be set according to the actual situation, specifically, such as the last 1 month or the last 1 year. The server can filter the white list accounts and/or accounts with the transaction times exceeding a preset threshold value within a preset duration, which are contained in the association relation map between the accounts, so as to obtain the association relation map between the filtered accounts.

In step S310, the accounts included in the transaction data are grouped based on the association relationship map between the accounts, so as to obtain at least one account group.

The specific processing procedure of step S310 may be referred to the above related content, and will not be described herein.

In step S312, the association relationship maps between the accounts included in at least one account group are input into the map processing model, respectively, to obtain map representation information corresponding to the association relationship maps between the accounts included in each account group.

The specific processing procedure of the step S312 may be referred to fig. 4 and the related content, and will not be described herein.

In step S314, a similarity between the graph representation information corresponding to the association relationship graph between the accounts included in each account group and the sub-graph representation information corresponding to the abnormal sub-graph in the abnormal graph database is obtained.

The map representation information may be related information capable of representing an association relationship map, and in practical application, the map representation information may be constructed and presented in various different manners, and may be specifically set according to practical situations, which is not limited in the embodiments of the present specification.

The specific processing of step S314 described above may be implemented as follows: determining similarity between map representation information corresponding to the association relationship maps among accounts contained in each account group and sub-map representation information corresponding to the abnormal sub-map in the abnormal map database based on a preset similarity algorithm; wherein the predetermined similarity algorithm comprises any one of Euclidean distance algorithm, manhattan distance algorithm, chebyshev distance algorithm, minkowski distance algorithm, mahalanobis distance algorithm, cosine distance algorithm, hamming distance algorithm, and Jacquard distance algorithm.

It should be noted that the specific processing in step S314 may also be implemented in the following manner: the method comprises the steps of inputting map representation information corresponding to an association relation map between accounts contained in each account group and sub-map representation information corresponding to an abnormal sub-map in an abnormal map database into a preset similarity model to obtain similarity between the map representation information corresponding to the association relation map between accounts contained in each account group and sub-map representation information corresponding to the abnormal sub-map in the abnormal map database; wherein the similarity model may be built by a predetermined algorithm, for example by one or more of the euclidean distance algorithm, the manhattan distance algorithm, the chebyshev distance algorithm, the minkowski distance algorithm, the mahalanobis distance algorithm, the cosine distance algorithm, the hamming distance algorithm, and the jaccard distance algorithm, etc.

In step S316, it is determined whether the account group is an abnormal group in which a predetermined risk exists, based on the acquired similarity.

In implementation, after obtaining the similarity between the graph representation information corresponding to the association relationship graph between the accounts included in the account group and the sub-graph representation information corresponding to the abnormal sub-graph in the predetermined abnormal graph database through the above method, the obtained value of the similarity can be compared with a preset similarity threshold value, the association relationship graph and the abnormal sub-graph between the accounts included in the account group with the value of the similarity greater than the similarity threshold value are obtained, and the risk corresponding to the obtained abnormal sub-graph can be used as the risk corresponding to the account group, if the risk corresponding to the abnormal sub-graph is a fraud risk, the risk corresponding to the account group is also a fraud risk.

The embodiment of the specification provides a detection method of a transaction abnormal group, which is characterized in that based on transaction data of users, an association relation graph between accounts contained in the transaction data is constructed, based on the association relation graph between accounts, accounts contained in the transaction data are grouped to obtain at least one account group, the order of the accounts in the association relation graph between the accounts contained in the account group is disturbed to obtain the association relation graph between the accounts contained in the disturbed account group, so that the association relation graph belonging to the same category is constructed in a mode that a certain determined association relation graph is disturbed in order of the accounts, the structure of the graph can be further emphasized, the detection applicability of the transaction abnormal group is higher, and based on the association relation graph between the accounts contained in the disturbed account group and the association relation between the accounts contained in the account group, a graph processing model is further determined whether the account group is an abnormal group with preset risk or not based on the graph processing model, so that the detection process of the abnormal group can be simplified and the detection process of the abnormal group can be applied to the complex graph.

In addition, the similarity between the maps is learned based on the combination mode of the graphic neural network model, the triple Loss model and the like, so that the detection process of the transaction abnormal group can be further simplified, and the similarity between the maps is measured by comparing the Embeddding of different associated house maps, so that whether the account group is the abnormal group with the preset risk or not is determined, and the detection process of the transaction abnormal group is further simplified.

Example III

The method for detecting a transaction anomaly group provided in the embodiment of the present disclosure is based on the same concept, and the embodiment of the present disclosure further provides a device for detecting a transaction anomaly group, as shown in fig. 5.

The detection device of the transaction abnormal group comprises: a graph construction module 501, a group partitioning module 502, and an anomaly group determination module 503, wherein:

the map construction module 501 constructs an association relationship map between accounts contained in transaction data based on the transaction data of a user;

the group division module 502 groups accounts contained in the transaction data based on the association relationship graph between the accounts to obtain at least one account group;

an anomaly group determining module 503, configured to determine, by means of pattern matching, whether the account group is an anomaly group having a predetermined risk, based on an association relationship pattern between accounts included in the at least one account group, an anomaly subgraph in a predetermined anomaly pattern database, and a predetermined pattern processing model.

In the embodiment of the present disclosure, the anomaly group determining module 503 includes:

the characterization information determining unit is used for respectively inputting the association relation patterns among the accounts contained in the at least one account group into the pattern processing model to obtain pattern characterization information corresponding to the association relation patterns among the accounts contained in each account group;

a similarity determining unit, configured to obtain similarity between graph representation information corresponding to an association relationship graph between accounts included in each account group and sub-graph representation information corresponding to an abnormal sub-graph in the abnormal graph database;

an abnormal group determination unit that determines whether the account group is an abnormal group in which a predetermined risk exists, based on the acquired similarity.

In an embodiment of the present disclosure, the apparatus further includes:

the history map acquisition module is used for acquiring a plurality of history account groups and association relation maps among accounts contained in each history account group;

and the training module is used for training the graph processing model based on the association relation graphs among the accounts contained in the historical account groups to obtain a trained graph processing model.

In an embodiment of the present disclosure, the training module includes:

the map processing unit is used for carrying out disorder processing on the account sequence in the association relation map among the accounts contained in the first historical account group to obtain the association relation map among the disturbed accounts contained in the first historical account group;

the training unit is used for training the pattern processing model based on the association relation pattern among the disturbed accounts contained in the first historical account group, the association relation pattern among the accounts contained in the first historical account group and the association relation pattern among the accounts contained in the second historical account group to obtain a trained pattern processing model, and the first historical account group and the second historical account group are any two different historical account groups in the plurality of historical account groups.

In the embodiment of the present disclosure, the atlas handling model is constructed by a preset neural network model, an embedded function, and a Triplet Loss model.

In the embodiment of the present disclosure, the neural network model is a graph neural network model.

In the embodiment of the present disclosure, the neural network model is a convolutional neural network model.

In this embodiment of the present disclosure, the similarity determining unit determines, based on a predetermined similarity algorithm, a similarity between graph representation information corresponding to an association relationship graph between accounts included in each account group and sub-graph representation information corresponding to an abnormal sub-graph in the abnormal graph database;

wherein the predetermined similarity algorithm comprises any one of a Euclidean distance algorithm, a Manhattan distance algorithm, a Chebyshev distance algorithm, a Minkowski distance algorithm, a Mahalanobis distance algorithm, a cosine distance algorithm, a Hamming distance algorithm, and a Jacquard distance algorithm.

In an embodiment of the present disclosure, the apparatus further includes:

and the account filtering module is used for filtering the preset accounts contained in the association relation map between the accounts to obtain the association relation map between the filtered accounts, wherein the preset accounts comprise one or more of a preset white list account and an account with the transaction times exceeding a preset threshold value within a preset duration.

The embodiment of the specification provides a detection device for a transaction abnormal group, which constructs an association relation map between accounts contained in transaction data based on the transaction data of a user, groups the accounts contained in the transaction data based on the association relation map between the accounts to obtain at least one account group, and carries out disorder processing on the order of the accounts in the association relation map between the accounts contained in the account group to obtain the association relation map between the accounts contained in the disturbed account group.

Example IV

The above device for detecting a transaction anomaly group provided in the embodiment of the present disclosure further provides a device for detecting a transaction anomaly group based on the same concept, as shown in fig. 6.

The detection device of the transaction anomaly group may be a server provided in the above embodiment.

The detection device of the transaction anomaly group may have a relatively large difference due to different configurations or performances, and may include one or more processors 601 and a memory 602, where the memory 602 may store one or more storage applications or data. Wherein the memory 602 may be transient storage or persistent storage. The application program stored in the memory 602 may include one or more modules (not shown in the figures) each of which may include a series of computer executable instructions in the detection device for the transaction anomaly group. Still further, the processor 601 may be configured to communicate with the memory 602 to execute a series of computer executable instructions in the memory 602 on the detection device of the transaction anomaly group. The transaction anomaly group detection device may also include one or more power supplies 603, one or more wired or wireless network interfaces 604, one or more input/output interfaces 605, and one or more keyboards 606.

In particular, in this embodiment, the transaction anomaly group detection device includes a memory, and one or more programs, where the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer-executable instructions in the transaction anomaly group detection device, and configured to be executed by the one or more processors, the one or more programs including computer-executable instructions for:

constructing an association relationship map between accounts contained in transaction data based on the transaction data of a user;

grouping accounts contained in the transaction data based on the association relationship graph between the accounts to obtain at least one account group;

determining whether the account group is an abnormal group with a preset risk or not in a pattern matching mode based on an association relation pattern between accounts contained in the at least one account group, an abnormal subgraph in a preset abnormal pattern database and a preset pattern processing model.

In this embodiment of the present disclosure, the determining, by means of pattern matching, whether the account group is an abnormal group with a predetermined risk based on an association relationship pattern between accounts included in the at least one account group and an abnormal subgraph in a predetermined abnormal pattern database, and a predetermined pattern processing model includes:

Inputting the association relation patterns among the accounts contained in the at least one account group into the pattern processing model respectively to obtain pattern characterization information corresponding to the association relation patterns among the accounts contained in each account group;

obtaining similarity between map representation information corresponding to an association relationship map between accounts contained in each account group and sub-map representation information corresponding to an abnormal sub-map in the abnormal map database;

based on the obtained similarity, it is determined whether the account group is an abnormal group at a predetermined risk.

In this embodiment of the present specification, further includes:

acquiring a plurality of historical account groups and an association relation map among accounts contained in each historical account group;

and training the graph processing model based on the association relationship graph among the accounts contained in the historical account groups to obtain a trained graph processing model.

In this embodiment of the present disclosure, training the graph processing model based on the association relationship graphs between accounts included in the plurality of historical account groups to obtain a trained graph processing model includes:

The method comprises the steps that the order of accounts in an association relation map among accounts contained in a first historical account group is disturbed, and the association relation map among the disturbed accounts contained in the first historical account group is obtained;

training the pattern processing model based on the association relationship pattern between the accounts contained in the disturbed first historical account group, the association relationship pattern between the accounts contained in the first historical account group and the association relationship pattern between the accounts contained in the second historical account group to obtain a trained pattern processing model, wherein the first historical account group and the second historical account group are any two different historical account groups in the plurality of historical account groups.

In this embodiment of the present disclosure, the obtaining a similarity between graph representation information corresponding to an association relationship graph between accounts included in each account group and sub-graph representation information corresponding to an abnormal sub-graph in the abnormal graph database includes:

Determining similarity between map representation information corresponding to an association relationship map between accounts contained in each account group and sub-map representation information corresponding to an abnormal sub-map in the abnormal map database based on a predetermined similarity algorithm;

In this embodiment of the present specification, further includes:

filtering a preset account contained in the association relation map between the accounts to obtain the association relation map between the filtered accounts, wherein the preset account comprises one or more of a preset white list account and an account with transaction times exceeding a preset threshold value within a preset duration.

The embodiment of the specification provides a detection device for a transaction abnormal group, which constructs an association relation graph between accounts contained in transaction data based on the transaction data of a user, groups the accounts contained in the transaction data based on the association relation graph between the accounts to obtain at least one account group, and carries out disorder processing on the order of the accounts in the association relation graph between the accounts contained in the account group to obtain the association relation graph between the accounts contained in the disturbed account group.

The foregoing describes specific embodiments of the present disclosure. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims can be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

In the 90 s of the 20 th century, improvements to one technology could clearly be distinguished as improvements in hardware (e.g., improvements to circuit structures such as diodes, transistors, switches, etc.) or software (improvements to the process flow). However, with the development of technology, many improvements of the current method flows can be regarded as direct improvements of hardware circuit structures. Designers almost always obtain corresponding hardware circuit structures by programming improved method flows into hardware circuits. Therefore, an improvement of a method flow cannot be said to be realized by a hardware entity module. For example, a programmable logic device (Programmable Logic Device, PLD) (e.g., field programmable gate array (Field Programmable Gate Array, FPGA)) is an integrated circuit whose logic function is determined by the programming of the device by a user. A designer programs to "integrate" a digital system onto a PLD without requiring the chip manufacturer to design and fabricate application-specific integrated circuit chips. Moreover, nowadays, instead of manually manufacturing integrated circuit chips, such programming is mostly implemented by using "logic compiler" software, which is similar to the software compiler used in program development and writing, and the original code before the compiling is also written in a specific programming language, which is called hardware description language (Hardware Description Language, HDL), but not just one of the hdds, but a plurality of kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), lava, lola, myHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog are currently most commonly used. It will also be apparent to those skilled in the art that a hardware circuit implementing the logic method flow can be readily obtained by merely slightly programming the method flow into an integrated circuit using several of the hardware description languages described above.

The controller may be implemented in any suitable manner, for example, the controller may take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code (e.g., software or firmware) executable by the (micro) processor, logic gates, switches, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), programmable logic controllers, and embedded microcontrollers, examples of which include, but are not limited to, the following microcontrollers: ARC 625D, atmel AT91SAM, microchip PIC18F26K20, and Silicone Labs C8051F320, the memory controller may also be implemented as part of the control logic of the memory. Those skilled in the art will also appreciate that, in addition to implementing the controller in a pure computer readable program code, it is well possible to implement the same functionality by logically programming the method steps such that the controller is in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers, embedded microcontrollers, etc. Such a controller may thus be regarded as a kind of hardware component, and means for performing various functions included therein may also be regarded as structures within the hardware component. Or even means for achieving the various functions may be regarded as either software modules implementing the methods or structures within hardware components.

The system, apparatus, module or unit set forth in the above embodiments may be implemented in particular by a computer chip or entity, or by a product having a certain function. One typical implementation is a computer. In particular, the computer may be, for example, a personal computer, a laptop computer, a cellular telephone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

For convenience of description, the above devices are described as being functionally divided into various units, respectively. Of course, the functionality of the units may be implemented in one or more software and/or hardware when implementing one or more embodiments of the present description.

It will be appreciated by those skilled in the art that embodiments of the present description may be provided as a method, system, or computer program product. Accordingly, one or more embodiments of the present description may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Moreover, one or more embodiments of the present description can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

Embodiments of the present description are described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the specification. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable transaction anomaly group detection device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable transaction anomaly group detection device, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable transaction anomaly group detection device to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

In one typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

The memory may include volatile memory in a computer-readable medium, random Access Memory (RAM) and/or nonvolatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of computer-readable media.

Computer readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of storage media for a computer include, but are not limited to, phase change memory (PRAM), static Random Access Memory (SRAM), dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium, which can be used to store information that can be accessed by a computing device. Computer-readable media, as defined herein, does not include transitory computer-readable media (transmission media), such as modulated data signals and carrier waves.

It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article or apparatus that comprises the element.

One or more embodiments of the present specification may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. One or more embodiments of the present description may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.

In this specification, each embodiment is described in a progressive manner, and identical and similar parts of each embodiment are all referred to each other, and each embodiment mainly describes differences from other embodiments. In particular, for system embodiments, since they are substantially similar to method embodiments, the description is relatively simple, as relevant to see a section of the description of method embodiments.

The foregoing is merely exemplary of the present disclosure and is not intended to limit the disclosure. Various modifications and alterations to this specification will become apparent to those skilled in the art. Any modifications, equivalent substitutions, improvements, or the like, which are within the spirit and principles of the present description, are intended to be included within the scope of the claims of the present description.

Claims

1. A method of detecting a transaction anomaly group, the method comprising:

inputting the association relation patterns among the accounts contained in the at least one account group into a preset pattern processing model respectively to obtain pattern characterization information corresponding to the association relation patterns among the accounts contained in each account group;

obtaining similarity between map representation information corresponding to an association relation map between accounts contained in each account group and sub-map representation information corresponding to an abnormal sub-map in a preset abnormal map database;

2. The method of claim 1, the method further comprising:

3. The method of claim 2, wherein training the graph processing model based on the association relationships among accounts included in the plurality of historical account groups to obtain a trained graph processing model comprises:

4. A method according to claim 3, wherein the atlas handling model is constructed from a pre-set neural network model, an embedded function, and a Triplet Loss model.

5. The method of claim 4, the neural network model being a graph neural network model.

6. The method of claim 4, the neural network model being a convolutional neural network model.

7. The method of claim 1, wherein the obtaining similarity between the graph representation information corresponding to the association graph between the accounts included in each account group and the subgraph representation information corresponding to the abnormal subgraph in the abnormal graph database includes:

8. The method of claim 1, the method further comprising:

9. A device for detecting a transaction anomaly group, the device comprising:

the first map construction module is used for constructing an association relation map between accounts contained in transaction data based on the transaction data of the user;

the group division module is used for grouping accounts contained in the transaction data based on the association relation graph among the accounts to obtain at least one account group;

the abnormal group determining module is used for respectively inputting the association relation patterns among the accounts contained in the at least one account group into a preset pattern processing model to obtain pattern characterization information corresponding to the association relation patterns among the accounts contained in each account group; obtaining similarity between map representation information corresponding to an association relation map between accounts contained in each account group and sub-map representation information corresponding to an abnormal sub-map in a preset abnormal map database; based on the obtained similarity, it is determined whether the account group is an abnormal group at a predetermined risk.

10. The apparatus of claim 9, the apparatus further comprising:

11. The apparatus of claim 10, the training module comprising:

12. The apparatus of claim 11, the atlas handling model is constructed from a pre-set neural network model, an assembled function, and a Triplet Loss model.

13. A transaction anomaly group detection device, characterized in that the transaction anomaly group detection device includes:

a processor; and

a memory arranged to store computer executable instructions that, when executed, cause the processor to: